DORA. Plus MaRisk. Plus Annex I where it applies.

Yes, but not with a second management system. § 28 Abs. 6 Nr. 1 of the German BSIG exempts DORA financial entities from §§ 30, 31, 32, 35, 36, 38 and 39 BSIG: ICT risk management and incident reporting run under DORA via BaFin. The exemption covers those substantive duties, not the status as an entity. Above all, registration with the BSI under § 33 BSIG remains, because § 33 is not on the exemption list. A credit institution, trading venue or central counterparty that meets the size thresholds therefore has to register, even though day-to-day operations follow DORA. The deadline is three months from the point the conditions are met; for entities already in scope when the law took effect on 6 December 2025 it expired on 6 March 2026. Management responsibility does not fall away either: DORA assigns it to the management body itself, including regular ICT risk training. OdySecure maps both regimes from one control set so that no second system grows alongside.

EBA/CP/2025/12 is a consultation paper (draft) and outlines 19 fields, including: unique contract number, function, criticality, data flows, data location, subcontractor identity, contractual SLA, termination conditions, exit strategy. OdySecure contains a prepared outsourcing register with all 19 fields and AI support for contract analysis. Adaptable to the final EBA wording without re-engineering.

The BAIT, BaFin’s circular on IT requirements, are being phased out: BaFin removed DORA-covered financial entities from the BAIT scope as of 17 January 2025, and according to BaFin the remaining BAIT will be repealed step by step by the end of 2026. The MaRisk, BaFin supervisory expectations rather than a statute, remain in force. A modern ISMS covers MaRisk, DORA and BSIG requirements largely from a single control set.

If contracts exist digitally, typically 4 to 8 weeks to a fit-for-supervision register. The AI-supported contract analysis extracts EBA mandatory fields largely automatically, the compliance team verifies and supplements. Manual capture takes substantially longer.

Platform licence for a mid-sized bank (around 500 employees) from the low five-figure range per year; an onboarding project with senior CISO support is bookable on top. Specific indication on request, since corporate pricing is project-based. The initial call delivers a first cost estimate.